@tuturuuu/utils 0.33.1 → 0.33.3

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [0.33.3](https://github.com/tutur3u/platform/compare/utils-v0.33.2...utils-v0.33.3) (2026-10-02)
+
+
+### Bug Fixes
+
+* **calendar:** preserve opaque rendering cues and hydrate source colors ([33847dd](https://github.com/tutur3u/platform/commit/33847ddcd8a3cf2b5cef8ebf50ca4c1700424a27))
+* **calendar:** render opaque readable event colors ([#5694](https://github.com/tutur3u/platform/issues/5694)) ([6e3d81d](https://github.com/tutur3u/platform/commit/6e3d81d6fdd6f8155f12e36ede58d31fde0ac362))
+* **mobile:** harden timezone retry recovery ([264b4b8](https://github.com/tutur3u/platform/commit/264b4b89ab9e1cb4194374a3714b46832c5e486a))
+* **mobile:** resolve timezone settings with verified native sessions ([#5720](https://github.com/tutur3u/platform/issues/5720)) ([5640ca2](https://github.com/tutur3u/platform/commit/5640ca22bcbfda6cd0470f39171ffa2366af779e))
+* **mobile:** restore verified timezone resolution ([462c68b](https://github.com/tutur3u/platform/commit/462c68bf22b2b412dd1825c12c3558b10b028a40))
+* **mobile:** retain timezone snapshots during overlapping loads ([eff42e2](https://github.com/tutur3u/platform/commit/eff42e2cf9d3159ee6fc68be1079df5f50fd92e2))
+
+## [0.33.2](https://github.com/tutur3u/platform/compare/utils-v0.33.1...utils-v0.33.2) (2026-10-01)
+
+
+### Bug Fixes
+
+* **calendar:** preserve Google color identity and inheritance ([#5657](https://github.com/tutur3u/platform/issues/5657)) ([0c2aac6](https://github.com/tutur3u/platform/commit/0c2aac6a1a2b6e9f6eb66bde1e783bf407603cff))
+* **calendar:** preserve Google provider color identity and inheritance ([08f2363](https://github.com/tutur3u/platform/commit/08f236349d1dc29ad0593de8f668d5ce504f38d0))
+
 ## [0.33.1](https://github.com/tutur3u/platform/compare/utils-v0.33.0...utils-v0.33.1) (2026-09-29)
 
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.33.1",
+  "version": "0.33.3",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -24,7 +24,7 @@
     "@tiptap/react": "3.31.3",
     "@tuturuuu/google": "0.1.1",
     "@tuturuuu/icons": "0.1.1",
-    "@tuturuuu/internal-api": "0.47.0",
+    "@tuturuuu/internal-api": "0.48.0",
     "@tuturuuu/supabase": "0.5.2",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.4",
@@ -41,11 +41,11 @@
     "server-only": "^0.0.1",
     "uuid": "^14.0.2",
     "y-prosemirror": "^1.3.7",
-    "yjs": "^13.6.32",
+    "yjs": "^13.6.33",
     "zod": "^4.6.2"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.33.0",
+    "@tuturuuu/types": "0.33.1",
     "@tuturuuu/typescript-config": "0.1.2",
     "@types/diff": "^8.0.0",
     "@types/node": "^26.5.1",

package/src/__tests__/api-proxy-bearer-trust.test.ts

@@ -0,0 +1,193 @@
+import { NextRequest } from 'next/server';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+  limit: vi.fn(),
+  trust: vi.fn(),
+  blocked: vi.fn(),
+  prefixes: [] as string[],
+}));
+vi.mock('../required-mfa-runtime', () => ({
+  enforceRequiredMfaRequest: async () => null,
+}));
+vi.mock('@tuturuuu/supabase/next/server', () => ({
+  createAdminClient: vi.fn(),
+}));
+vi.mock('@upstash/ratelimit', () => ({
+  Ratelimit: class {
+    static slidingWindow() {
+      return {};
+    }
+    constructor(config: { prefix: string }) {
+      mocks.prefixes.push(config.prefix);
+    }
+    limit(key: string) {
+      return mocks.limit(key);
+    }
+  },
+}));
+vi.mock('@upstash/redis', () => ({
+  Redis: class {
+    static fromEnv() {
+      return {};
+    }
+  },
+}));
+vi.mock('../abuse-protection/edge', () => ({
+  extractIPFromRequest: () => '192.0.2.1',
+  isIPBlockedEdge: () => mocks.blocked(),
+  readEdgeAbuseProtectionControls: async () => ({
+    ipBlockingEnabled: true,
+    rateLimitsEnabled: true,
+  }),
+}));
+vi.mock('../abuse-protection/edge-trust', () => ({
+  getCachedTrustEntries: (keys: string[]) => mocks.trust(keys),
+  hasCachedIpBlockAppealRelief: async () => false,
+}));
+vi.mock('../request-emoji-limit', () => ({
+  validateRequestEmojiLimit: async () => null,
+}));
+
+// Use the actual server subject builder, rather than a separately invented hash.
+import { buildAbuseRiskSubjects } from '../abuse-protection/reputation';
+
+const path = '/api/v1/mobile-calendar/api/v1/users/calendar-settings';
+const token = 'synthetic-native-session';
+function verifiedKey(value = token) {
+  return buildAbuseRiskSubjects({
+    headers: { authorization: `Bearer ${value}` },
+    userId: 'synthetic-user',
+  }).find((subject) => subject.subject_type === 'session')!.subject_key;
+}
+async function request(authorization = `Bearer ${token}`, cookie?: string) {
+  const { guardApiProxyRequest } = await import('../api-proxy-guard.js');
+  return guardApiProxyRequest(
+    new NextRequest(`https://infra.test${path}`, {
+      headers: { authorization, ...(cookie ? { cookie } : {}) },
+    }),
+    { prefixBase: 'proxy:infra:api' }
+  );
+}
+
+describe('native Calendar gateway verified session parity', () => {
+  beforeEach(() => {
+    vi.resetModules();
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'synthetic');
+    vi.stubEnv('API_PROXY_EDGE_TRUST_ENABLED', '1');
+    mocks.prefixes.length = 0;
+    mocks.limit.mockReset().mockResolvedValue({
+      success: false,
+      limit: 60,
+      remaining: 0,
+      reset: Date.now() + 30_000,
+    });
+    mocks.blocked.mockReset().mockResolvedValue(null);
+    mocks.trust.mockReset().mockResolvedValue(new Map());
+  });
+  afterEach(() => vi.unstubAllEnvs());
+
+  it('allows a verified native session with available per-session budget', async () => {
+    const key = verifiedKey();
+    mocks.trust.mockResolvedValue(new Map([[key, { m: 1, verified: true }]]));
+    mocks.limit.mockResolvedValue({
+      success: true,
+      limit: 60,
+      remaining: 59,
+      reset: Date.now() + 30_000,
+    });
+    expect(await request()).toBeNull();
+    expect(mocks.limit).toHaveBeenCalledWith(key);
+  });
+
+  it('keeps unsupported separator whitespace aligned with server cache keys', async () => {
+    const header = `Bearer  ${token}`;
+    const sessionSubject = (authorization: string) =>
+      buildAbuseRiskSubjects({
+        headers: { authorization },
+        userId: 'synthetic-user',
+      }).find((subject) => subject.subject_type === 'session');
+    expect(sessionSubject(`Bearer ${token}`)?.subject_key).toBe(verifiedKey());
+    expect(sessionSubject(header)).toBeUndefined();
+    mocks.trust.mockResolvedValue(
+      new Map([[verifiedKey(), { m: 1, verified: true }]])
+    );
+    const response = await request(header);
+    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe('anonymous');
+    expect(mocks.limit).toHaveBeenCalledWith('ip:192.0.2.1');
+  });
+
+  it('uses exactly the authenticated server key, preserving rate limits and Retry-After', async () => {
+    const key = verifiedKey();
+    mocks.trust.mockImplementation(async (keys: string[]) => {
+      expect(keys).toContain(key);
+      expect(JSON.stringify(keys)).not.toContain(token);
+      return new Map([[key, { m: 1, verified: true }]]);
+    });
+    const response = await request();
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe(
+      'authenticated'
+    );
+    expect(response?.headers.get('Retry-After')).toBe('30');
+    expect(mocks.limit).toHaveBeenCalledWith(key);
+    expect(mocks.prefixes).toContain(
+      'proxy:infra:api:default:authenticated:get:minute'
+    );
+  });
+
+  it.each([`Bearer forged`, `Bearer ${token}`, 'Bearer malformed token'])(
+    'unverified or evicted credentials retain the anonymous IP budget: %s',
+    async (header) => {
+      const response = await request(header);
+      expect(response?.status).toBe(429);
+      expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe(
+        'anonymous'
+      );
+      expect(mocks.limit).toHaveBeenCalledWith('ip:192.0.2.1');
+    }
+  );
+
+  it('rotated credentials cannot inherit the old session cache entry', async () => {
+    mocks.trust.mockResolvedValue(
+      new Map([[verifiedKey(), { m: 1, verified: true }]])
+    );
+    const response = await request('Bearer rotated-session');
+    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe('anonymous');
+    expect(mocks.limit).toHaveBeenCalledWith('ip:192.0.2.1');
+  });
+
+  it('uses Bearer precedence even when a different trusted cookie is present', async () => {
+    const { buildProxySessionSubjectKey } = await import(
+      '../api-proxy-guard.js'
+    );
+    const cookieKey = await buildProxySessionSubjectKey(
+      'sb-test-auth-token',
+      'cookie'
+    );
+    mocks.trust.mockResolvedValue(
+      new Map([[cookieKey, { m: 1, verified: true }]])
+    );
+    const response = await request(
+      'Bearer forged',
+      'sb-test-auth-token=cookie'
+    );
+    expect(response?.headers.get('X-RateLimit-Caller-Class')).toBe('anonymous');
+  });
+
+  it('retains IP blocks even for verified native sessions', async () => {
+    mocks.trust.mockResolvedValue(
+      new Map([[verifiedKey(), { m: 1, verified: true }]])
+    );
+    mocks.blocked.mockResolvedValue({
+      expiresAt: new Date(Date.now() + 60_000),
+    });
+    const response = await request();
+    expect(response?.headers.get('X-Proxy-Block-Reason')).toBe(
+      'ip-already-blocked'
+    );
+    expect(mocks.limit).not.toHaveBeenCalled();
+  });
+});

package/src/__tests__/calendar-event-colors.test.ts

@@ -0,0 +1,103 @@
+import { describe, expect, it } from 'vitest';
+import {
+  calendarColorForeground,
+  calendarEventColors,
+  calendarEventStyle,
+} from '../calendar-event-colors';
+
+const metadata = (inherited: boolean, background: unknown = '#abcdef') => ({
+  google_color: { version: 1, inherited, background },
+});
+
+describe('effective opaque calendar rendering', () => {
+  it('preserves explicit provider RGB instead of the canonical FK or source RGB', () => {
+    expect(
+      calendarEventStyle({
+        color: 'BLUE',
+        _calendarColor: '#ff0000',
+        scheduling_metadata: metadata(false, '#00ff88'),
+      })
+    ).toEqual({
+      backgroundColor: '#00ff88',
+      borderColor: '#00ff88',
+      color: '#000000',
+    });
+  });
+  it('updates inherited events from current source RGB before historical metadata', () => {
+    expect(
+      calendarEventColors({
+        _calendarColor: '#ff80ab',
+        scheduling_metadata: metadata(true, '#00ff88'),
+      }).background
+    ).toBe('#ff80ab');
+  });
+  it('retains resolved inherited metadata when current source RGB is unavailable', () => {
+    expect(
+      calendarEventColors({
+        _calendarColor: 'rgba(0,0,0,.1)',
+        scheduling_metadata: metadata(true),
+      }).background
+    ).toBe('#abcdef');
+  });
+  it('does not infer inheritance for unknown explicit or legacy rows', () => {
+    for (const scheduling_metadata of [
+      undefined,
+      metadata(false, null),
+      metadata(false, '#ff000080'),
+    ]) {
+      expect(
+        calendarEventStyle({
+          color: 'GREEN',
+          _calendarColor: '#ff80ab',
+          scheduling_metadata,
+        }).backgroundColor
+      ).toBe('#4caf50');
+    }
+  });
+  it('retains legacy grey and stored grey RGB aliases', () => {
+    expect(calendarEventColors({ color: 'grey' }).background).toBe('#9e9e9e');
+    expect(calendarEventColors({ color: '#6b7280' }).background).toBe(
+      '#6b7280'
+    );
+  });
+  it('uses readable opaque text across pale and dark colors', () => {
+    expect(calendarColorForeground('#ffffff')).toBe('#000000');
+    expect(calendarColorForeground('#000000')).toBe('#ffffff');
+    for (const background of [
+      '#a4bdfc',
+      '#7ae7bf',
+      '#dbadff',
+      '#ff887c',
+      '#fbd75b',
+      '#ffb878',
+      '#46d6db',
+      '#e1e1e1',
+      '#5484ed',
+      '#51b749',
+      '#dc2127',
+      ...[
+        'BLUE',
+        'RED',
+        'GREEN',
+        'YELLOW',
+        'PURPLE',
+        'PINK',
+        'ORANGE',
+        'INDIGO',
+        'CYAN',
+        'GRAY',
+        'grey',
+        '#6b7280',
+      ].map((color) => calendarEventColors({ color }).background),
+    ]) {
+      const text = calendarColorForeground(background);
+      const rgb = [1, 3, 5]
+        .map((i) => parseInt(background.slice(i, i + 2), 16) / 255)
+        .map((c) => (c <= 0.04045 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4));
+      const l = rgb[0]! * 0.2126 + rgb[1]! * 0.7152 + rgb[2]! * 0.0722;
+      expect(
+        text === '#000000' ? (l + 0.05) / 0.05 : 1.05 / (l + 0.05)
+      ).toBeGreaterThanOrEqual(4.5);
+    }
+  });
+});

package/src/api-proxy-guard.ts

@@ -886,19 +886,6 @@ function parseCookieHeaderEdge(
     );
 }
 
-function getSessionAuthCookie(
-  req: NextRequest
-): { name: string; value: string } | null {
-  const cookies = parseCookieHeaderEdge(req.headers.get('cookie'));
-  return (
-    cookies.find(
-      (cookie) =>
-        cookie.name === 'tuturuuu_app_session' ||
-        GENERIC_SUPABASE_AUTH_COOKIE_NAME_PATTERN.test(cookie.name)
-    ) ?? null
-  );
-}
-
 export async function getProxySessionSubjectKeyFromCookieHeader(
   cookieHeader: string | null
 ): Promise<string | null> {
@@ -969,10 +956,15 @@ async function resolveProxyIdentity(
   ip: string
 ): Promise<ProxyIdentity> {
   const normalizedIp = ip && ip !== 'unknown' ? ip : null;
-  const sessionCookie = getSessionAuthCookie(req);
-  const sessionKey = sessionCookie
-    ? await buildProxySessionSubjectKey(sessionCookie.name, sessionCookie.value)
-    : null;
+  // Match the server's verified session cache key; header presence grants no trust.
+  const bearer = req.headers
+    .get('authorization')
+    ?.match(/^Bearer ([^\s]+)$/i)?.[1];
+  const sessionKey = bearer
+    ? await buildProxySessionSubjectKey('bearer', bearer)
+    : await getProxySessionSubjectKeyFromCookieHeader(
+        req.headers.get('cookie')
+      );
 
   return {
     cidrKey: getCidrSubjectKeyEdge(normalizedIp),

package/src/calendar-event-colors.ts

@@ -0,0 +1,62 @@
+import {
+  opaqueGoogleColor,
+  readGoogleEventColor,
+} from './google-calendar-colors';
+
+/** Stable opaque fallback for first-party and legacy rows without provider RGB. */
+const canonicalBackgrounds: Record<string, string> = {
+  BLUE: '#2196f3',
+  RED: '#f44336',
+  GREEN: '#4caf50',
+  YELLOW: '#ffeb3b',
+  PURPLE: '#9c27b0',
+  PINK: '#e91e63',
+  ORANGE: '#ff9800',
+  INDIGO: '#3f51b5',
+  CYAN: '#00bcd4',
+  GRAY: '#9e9e9e',
+  GREY: '#9e9e9e',
+  '#6B7280': '#6b7280',
+};
+
+type ColorEvent = {
+  color?: string | null;
+  scheduling_metadata?: unknown;
+  _calendarColor?: string | null;
+};
+
+/** Choose the higher contrast of black/white (at least 4.5:1 for any RGB). */
+export function calendarColorForeground(background: string): string {
+  const channels = [1, 3, 5].map((offset) => {
+    const value =
+      Number.parseInt(background.slice(offset, offset + 2), 16) / 255;
+    return value <= 0.04045 ? value / 12.92 : ((value + 0.055) / 1.055) ** 2.4;
+  });
+  const luminance =
+    channels[0]! * 0.2126 + channels[1]! * 0.7152 + channels[2]! * 0.0722;
+  return (luminance + 0.05) / 0.05 >= 1.05 / (luminance + 0.05)
+    ? '#000000'
+    : '#ffffff';
+}
+
+export function calendarEventColors(event: ColorEvent) {
+  const google = readGoogleEventColor(event.scheduling_metadata);
+  // Only known inherited intent uses the current source calendar color.
+  // Explicit unknown colors and legacy rows never silently become inherited.
+  const background =
+    (google?.inherited ? opaqueGoogleColor(event._calendarColor) : null) ??
+    google?.background ??
+    canonicalBackgrounds[event.color?.trim().toUpperCase() ?? 'BLUE'] ??
+    canonicalBackgrounds.BLUE!;
+  return { background, foreground: calendarColorForeground(background) };
+}
+
+/** Inline RGB wins over theme color classes without reducing fill opacity. */
+export function calendarEventStyle(event: ColorEvent) {
+  const { background, foreground } = calendarEventColors(event);
+  return {
+    backgroundColor: background,
+    color: foreground,
+    borderColor: background,
+  };
+}

package/src/common/metadata.test.ts

@@ -330,7 +330,19 @@ describe('application metadata coverage', () => {
       )
       .map((entry) => resolve(entry.parentPath, entry.name));
 
-    expect(marketingLayouts).toHaveLength(45);
+    // Guard concrete entry points while allowing new public pages to opt in.
+    // A fixed layout count rejects valid additions without testing SEO behavior.
+    const criticalLayouts = [
+      '(landing)/layout.tsx',
+      'about/layout.tsx',
+      'products/tasks/layout.tsx',
+      'privacy/layout.tsx',
+      'contributors/layout.tsx',
+      'women-in-tech/layout.tsx',
+    ].map((pathname) =>
+      resolve(repoRoot, 'apps/web/src/app/[locale]/(marketing)', pathname)
+    );
+    expect(marketingLayouts).toEqual(expect.arrayContaining(criticalLayouts));
     for (const layoutPath of marketingLayouts) {
       expect(readFileSync(layoutPath, 'utf8')).toMatch(/pathname:\s*['`]/);
     }

package/src/email/client.ts

@@ -31,11 +31,7 @@ export const isExactTuturuuuDotComEmail = (email?: string | null): boolean => {
   return /^[^\s@]+@tuturuuu\.com$/i.test(email.trim());
 };
 
-/** Routed QA domain. It is deliberately outside all staff-email allowlists. */
-export const isTuturuuuReviewEmail = (email?: string | null): boolean => {
-  if (!email) return false;
-  return /^[^\s@]+@tutur3u\.com$/i.test(email.trim());
-};
+export { isTuturuuuReviewEmail } from './reviewer-domain.mjs';
 
 export const isEmail = (text: string): boolean => {
   const emailRegex =

package/src/email/reviewer-domain.d.mts

@@ -0,0 +1 @@
+export function isTuturuuuReviewEmail(email?: string | null): boolean;

package/src/email/reviewer-domain.mjs

@@ -0,0 +1,6 @@
+/** Routed QA domain, deliberately outside all staff-email allowlists. */
+export function isTuturuuuReviewEmail(email) {
+  return (
+    typeof email === 'string' && /^[^\s@]+@tutur3u\.com$/i.test(email.trim())
+  );
+}

package/src/google-calendar-colors.test.ts

@@ -0,0 +1,87 @@
+import { describe, expect, it } from 'vitest';
+import {
+  googleColorCompatibilityValue,
+  opaqueGoogleColor,
+  resolveGoogleEventColor,
+} from './google-calendar-colors';
+
+describe('Google event color resolution', () => {
+  it('preserves inherited custom calendar RGB instead of substituting BLUE', () => {
+    expect(
+      resolveGoogleEventColor(
+        { colorId: null },
+        {
+          calendarId: 'personal',
+          calendarBackground: '#F691B2',
+          calendarForeground: '#000000',
+        }
+      )
+    ).toEqual({
+      version: 1,
+      calendar_id: 'personal',
+      color_id: null,
+      event_label_id: null,
+      inherited: true,
+      background: '#f691b2',
+      foreground: '#000000',
+      resolution: 'calendar',
+    });
+  });
+  it('uses all current event definitions, independently from calendar palette IDs', () => {
+    for (let id = 1; id <= 11; id++) {
+      const key = String(id);
+      expect(
+        resolveGoogleEventColor(
+          { colorId: key },
+          {
+            eventColors: {
+              [key]: { background: '#039BE5', foreground: '#ffffff' },
+            },
+            calendarBackground: '#f691b2',
+          }
+        )
+      ).toMatchObject({
+        color_id: key,
+        background: '#039be5',
+        inherited: false,
+        resolution: 'event',
+      });
+    }
+    expect(googleColorCompatibilityValue('7')).toBe('CYAN');
+    expect(googleColorCompatibilityValue('11')).toBe('RED');
+  });
+  it('prioritizes calendar-scoped labels over legacy color IDs', () => {
+    expect(
+      resolveGoogleEventColor(
+        { eventLabelId: 'custom-label', colorId: '7' },
+        {
+          eventLabels: [{ id: 'custom-label', backgroundColor: '#a123bc' }],
+          eventColors: { '7': { background: '#039be5' } },
+        }
+      )
+    ).toMatchObject({
+      event_label_id: 'custom-label',
+      color_id: '7',
+      background: '#a123bc',
+      resolution: 'label',
+    });
+  });
+  it('retains unknown explicit IDs and reports unresolved instead of inherited', () => {
+    expect(
+      resolveGoogleEventColor(
+        { eventLabelId: 'unknown' },
+        { calendarBackground: '#f691b2' }
+      )
+    ).toMatchObject({
+      inherited: false,
+      event_label_id: 'unknown',
+      background: null,
+      resolution: 'unresolved',
+    });
+  });
+  it('accepts only opaque RGB for rendering', () => {
+    expect(opaqueGoogleColor('#039BE5')).toBe('#039be5');
+    for (const value of ['#039be580', 'red', 'url(x)', '#fff'])
+      expect(opaqueGoogleColor(value)).toBeNull();
+  });
+});

package/src/google-calendar-colors.ts

@@ -0,0 +1,112 @@
+import type { SupportedColor } from '@tuturuuu/types/primitives/SupportedColors';
+
+export type GoogleColorDefinition = {
+  background?: string | null;
+  foreground?: string | null;
+};
+export type GoogleColorContext = {
+  calendarId?: string;
+  calendarBackground?: string | null;
+  calendarForeground?: string | null;
+  eventColors?: Record<string, GoogleColorDefinition> | null;
+  eventLabels?: { id?: string | null; backgroundColor?: string | null }[];
+};
+export type GoogleEventColor = {
+  version: 1;
+  calendar_id: string | null;
+  color_id: string | null;
+  event_label_id: string | null;
+  inherited: boolean;
+  background: string | null;
+  foreground: string | null;
+  resolution: 'calendar' | 'event' | 'label' | 'unresolved';
+};
+
+// Compatibility only for the existing canonical-color FK. Rendering uses RGB.
+const LEGACY_EVENT_COLORS: Record<string, SupportedColor> = {
+  '1': 'INDIGO',
+  '2': 'GREEN',
+  '3': 'PURPLE',
+  '4': 'PINK',
+  '5': 'YELLOW',
+  '6': 'ORANGE',
+  '7': 'CYAN',
+  '8': 'GRAY',
+  '9': 'BLUE',
+  '10': 'GREEN',
+  '11': 'RED',
+};
+export const GOOGLE_COLOR_IDS: Record<SupportedColor, string> = {
+  INDIGO: '1',
+  GREEN: '2',
+  PURPLE: '3',
+  PINK: '4',
+  YELLOW: '5',
+  ORANGE: '6',
+  CYAN: '7',
+  GRAY: '8',
+  BLUE: '9',
+  RED: '11',
+};
+export function googleColorCompatibilityValue(colorId?: string | null) {
+  return colorId ? (LEGACY_EVENT_COLORS[colorId] ?? 'BLUE') : 'BLUE';
+}
+export function opaqueGoogleColor(value: unknown): string | null {
+  return typeof value === 'string' && /^#[0-9a-f]{6}$/i.test(value)
+    ? value.toLowerCase()
+    : null;
+}
+export function resolveGoogleEventColor(
+  event: { colorId?: string | null; eventLabelId?: string | null },
+  context: GoogleColorContext = {}
+): GoogleEventColor {
+  const labelId = event.eventLabelId || null;
+  const colorId = event.colorId && event.colorId !== '0' ? event.colorId : null;
+  const inherited = !labelId && !colorId;
+  const label = context.eventLabels?.find((entry) => entry.id === labelId);
+  const definition = colorId ? context.eventColors?.[colorId] : undefined;
+  // An unknown explicit identity must not silently become an inherited color.
+  const background = opaqueGoogleColor(
+    labelId
+      ? label?.backgroundColor
+      : colorId
+        ? definition?.background
+        : context.calendarBackground
+  );
+  return {
+    version: 1,
+    calendar_id: context.calendarId ?? null,
+    color_id: colorId,
+    event_label_id: labelId,
+    inherited,
+    background,
+    foreground: labelId
+      ? null
+      : opaqueGoogleColor(
+          colorId ? definition?.foreground : context.calendarForeground
+        ),
+    resolution: !background
+      ? 'unresolved'
+      : labelId
+        ? 'label'
+        : colorId
+          ? 'event'
+          : 'calendar',
+  };
+}
+
+/** Provider metadata is read defensively; client metadata is never a write command. */
+export function readGoogleEventColor(
+  metadata: unknown
+): GoogleEventColor | null {
+  if (!metadata || typeof metadata !== 'object') return null;
+  const color = (metadata as Record<string, unknown>).google_color;
+  if (!color || typeof color !== 'object') return null;
+  const entry = color as GoogleEventColor;
+  if (entry.version !== 1 || typeof entry.inherited !== 'boolean') return null;
+  return {
+    ...entry,
+    background: opaqueGoogleColor(entry.background),
+    foreground: opaqueGoogleColor(entry.foreground),
+  };
+}

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.63.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.65.0'); // x-release-please-version
   });
 
   it('preserves the source timestamp in builtAt and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.63.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.65.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   /** ISO timestamp of the source commit used for the build, not deployment time. */